Siemens Flags High-Severity Flaws, Node2Shell Exposure in ICS Patch Tuesday

Industrial technology giant Siemens has issued nine new security advisories addressing ten vulnerabilities, including the impact of the recently identified Node2Shell flaw, as part of its ICS Patch Tuesday releases. Multiple other vendors, such as Schneider Electric, Phoenix Contact, Johnson Controls, and Hitachi Energy, have also published warnings about security weaknesses in their products.

The advisories highlight a range of high-severity issues that could expose critical industrial control systems (ICS) to serious attacks, potentially allowing threat actors to inject code, execute arbitrary code, access unauthorised data, and compromise entire systems.

For Siemens, two of the advisories detail the implications of the Node2Shell vulnerability across its product portfolio. While exploitation attempts of Node2Shell have been observed in the wild, Siemens noted there is no indication yet of attacks specifically targeting its products. Additional high-severity vulnerabilities were identified in products including ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA and PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. A low-severity issue in the Fortigate NGFW used by Ruggedcom APE1808 devices was also addressed.

Siemens has cautioned that patches are not yet available for several affected products, and some versions may not receive future fixes. Customers are strongly advised to apply the recommended mitigations provided in the company’s advisories.

Schneider Electric released one advisory concerning a medium-severity vulnerability in EcoStruxure Power Build Rapsody. This flaw could enable arbitrary code execution if malicious files are processed.

Germany’s VDE CERT published eight advisories this week, covering vulnerabilities found in products from Beckhoff, MB Connect Line, Helmholz, Weidmueller, Bender, and Ads-Tec. Several of these security holes relate to third-party components, including PHP and the PHP2Shell vulnerabilities.

In the days leading up to the official Patch Tuesday, Phoenix Contact also released advisories detailing the impact of PHP2Shell vulnerabilities and other issues affecting its PLCnext and related products.

Earlier this month, Johnson Controls issued two advisories. One addresses three vulnerabilities in EasyIO Neo IO Manager, with one flaw allowing for privilege escalation and arbitrary code execution. The second highlights an issue in the C•CURE 9000 3.20 / Victor 8.0 installer that could allow an attacker to obtain administrative credentials and authentication secrets.

Hitachi Energy also confirmed that at least one of its products is affected by the PHP2Shell vulnerabilities, underscoring the widespread impact of software dependencies in industrial environments.